@pagopa/io-wallet-oauth2 1.3.0 → 1.4.0

package/dist/index.d.mts

@@ -2,7 +2,7 @@ import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
 import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, ClientAttestationJwtPayload, RequestDpopOptions, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
 export { CallbackContext, ClientAttestationPopJwtHeader, ClientAttestationPopJwtPayload, DecryptJweCallback, EncryptJweCallback, GenerateRandomCallback, HashAlgorithm, JweEncryptor, JwtSigner, JwtSignerJwk, Oauth2JwtParseError, RequestDpopOptions, SignJwtCallback, VerifyJwtCallback, verifyJwt } from '@openid4vc/oauth2';
 import z, { z as z$1 } from 'zod';
-import { RequestLike as RequestLike$1, IoWalletSdkConfig, ItWalletSpecsVersion, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
+import { RequestLike as RequestLike$1, ItWalletSpecsVersion, IoWalletSdkConfig, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
 import { ItWalletAuthorizationServerMetadata } from '@pagopa/io-wallet-oid-federation';
 
 interface RetrieveAuthorizationCodeAccessTokenOptions {
@@ -423,6 +423,7 @@ type VerifiedClientAttestationPopJwt = Awaited<ReturnType<typeof verifyClientAtt
 declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationPopJwtOptions): Promise<{
     header: {
         [x: string]: unknown;
+        typ: "oauth-client-attestation-pop+jwt";
         alg: string;
         jwk?: {
             [x: string]: unknown;
@@ -457,12 +458,16 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
         } | undefined;
         kid?: string | undefined;
         trust_chain?: [string, ...string[]] | undefined;
-        typ?: string | undefined;
         x5c?: string[] | undefined;
     };
     payload: {
         [x: string]: unknown;
-        aud?: string | undefined;
+        aud: string;
+        iat: number;
+        iss: string;
+        jti: string;
+        exp?: number | undefined;
+        nonce?: string | undefined;
         cnf?: {
             [x: string]: unknown;
             jkt?: string | undefined;
@@ -498,18 +503,13 @@ declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationP
                 y?: string | undefined;
             } | undefined;
         } | undefined;
-        exp?: number | undefined;
-        iat?: number | undefined;
-        iss?: string | undefined;
-        jti?: string | undefined;
         nbf?: number | undefined;
-        nonce?: string | undefined;
         status?: Record<string, any> | undefined;
         trust_chain?: [string, ...string[]] | undefined;
     };
     signer: _openid4vc_oauth2.JwtSignerWithJwk;
 }>;
-interface CreateClientAttestationPopJwtOptions {
+interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersion> {
     /**
      * The audience authorization server identifier
      */
@@ -524,9 +524,10 @@ interface CreateClientAttestationPopJwtOptions {
      */
     clientAttestation: string;
     /**
-     * Expiration time of the JWT. If not provided 1 minute will be added to the `issuedAt`
+     * The IT-Wallet SDK configuration, used to select the correct version-specific
+     * payload shape for the client attestation PoP JWT.
      */
-    expiresAt?: Date;
+    config: IoWalletSdkConfig<V>;
     /**
      * Creation time of the JWT. If not provided the current date will be used
      */
@@ -543,7 +544,27 @@ interface CreateClientAttestationPopJwtOptions {
      */
     signer?: JwtSignerJwk$1;
 }
-declare function createClientAttestationPopJwt(options: CreateClientAttestationPopJwtOptions): Promise<string>;
+type NoClientAttestationPopJwtExtraOptions = Record<never, never>;
+interface CreateClientAttestationPopJwtVersionOptions {
+    [ItWalletSpecsVersion.V1_0]: {
+        /**
+         * Expiration time of the JWT.
+         * If not provided, 1 minute will be added to `issuedAt`.
+         */
+        expiresAt?: Date;
+    };
+    [ItWalletSpecsVersion.V1_3]: NoClientAttestationPopJwtExtraOptions;
+    [ItWalletSpecsVersion.V1_4]: NoClientAttestationPopJwtExtraOptions;
+}
+type CreateClientAttestationPopJwtExtraOptions<V extends ItWalletSpecsVersion> = [
+    V
+] extends [keyof CreateClientAttestationPopJwtVersionOptions] ? CreateClientAttestationPopJwtVersionOptions[V] : NoClientAttestationPopJwtExtraOptions;
+type CreateClientAttestationPopJwtOptionsForVersion<V extends ItWalletSpecsVersion> = BaseCreateClientAttestationPopJwtOptions<V> & CreateClientAttestationPopJwtExtraOptions<V>;
+type CreateClientAttestationPopJwtOptionsV1_0 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_0>;
+type CreateClientAttestationPopJwtOptionsV1_3 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_3>;
+type CreateClientAttestationPopJwtOptionsV1_4 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_4>;
+type CreateClientAttestationPopJwtOptions = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion>;
+declare function createClientAttestationPopJwt<V extends ItWalletSpecsVersion = ItWalletSpecsVersion>(options: CreateClientAttestationPopJwtOptionsForVersion<V>): Promise<string>;
 
 interface ClientAttestationOptions {
     /**
@@ -696,6 +717,7 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
     clientAttestationPop: {
         header: {
             [x: string]: unknown;
+            typ: "oauth-client-attestation-pop+jwt";
             alg: string;
             jwk?: {
                 [x: string]: unknown;
@@ -730,12 +752,16 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
             } | undefined;
             kid?: string | undefined;
             trust_chain?: [string, ...string[]] | undefined;
-            typ?: string | undefined;
             x5c?: string[] | undefined;
         };
         payload: {
             [x: string]: unknown;
-            aud?: string | undefined;
+            aud: string;
+            iat: number;
+            iss: string;
+            jti: string;
+            exp?: number | undefined;
+            nonce?: string | undefined;
             cnf?: {
                 [x: string]: unknown;
                 jkt?: string | undefined;
@@ -771,12 +797,7 @@ declare function verifyClientAttestation(options: VerifyClientAttestationOptions
                     y?: string | undefined;
                 } | undefined;
             } | undefined;
-            exp?: number | undefined;
-            iat?: number | undefined;
-            iss?: string | undefined;
-            jti?: string | undefined;
             nbf?: number | undefined;
-            nonce?: string | undefined;
             status?: Record<string, any> | undefined;
             trust_chain?: [string, ...string[]] | undefined;
         };
@@ -793,7 +814,7 @@ interface BaseVerifyWalletAttestationJwtOptions {
  * Base options shared across all wallet attestation versions
  */
 interface BaseWalletAttestationOptions {
-    callbacks: Pick<CallbackContext, "signJwt">;
+    callbacks: Pick<CallbackContext, "hash" | "signJwt">;
     dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
     expiresAt?: Date;
     issuer: string;
@@ -1290,7 +1311,7 @@ interface VerifyAccessTokenRequestResult {
  */
 declare function verifyAccessTokenRequest(options: VerifyAccessTokenRequestOptions): Promise<VerifyAccessTokenRequestResult>;
 
-declare const zAuthorizationRequest: z.ZodObject<{
+declare const zAuthorizationRequestV1_0: z.ZodObject<{
     authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         credential_configuration_id: z.ZodString;
         type: z.ZodLiteral<"openid_credential">;
@@ -1306,19 +1327,40 @@ declare const zAuthorizationRequest: z.ZodObject<{
     issuer_state: z.ZodOptional<z.ZodString>;
     jti: z.ZodString;
     redirect_uri: z.ZodURL;
+    response_type: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    state: z.ZodString;
     response_mode: z.ZodString;
+}, z.core.$loose>;
+type AuthorizationRequestV1_0 = z.infer<typeof zAuthorizationRequestV1_0>;
+declare const zAuthorizationRequestV1_3: z.ZodObject<{
+    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        credential_configuration_id: z.ZodString;
+        type: z.ZodLiteral<"openid_credential">;
+    }, z.core.$strip>, z.ZodObject<{
+        challenge_method: z.ZodLiteral<"mrtd+ias">;
+        challenge_redirect_uri: z.ZodURL;
+        idphinting: z.ZodURL;
+        type: z.ZodLiteral<"it_l2+document_proof">;
+    }, z.core.$strip>], "type">>>;
+    client_id: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodString;
+    issuer_state: z.ZodOptional<z.ZodString>;
+    jti: z.ZodString;
+    redirect_uri: z.ZodURL;
     response_type: z.ZodString;
     scope: z.ZodOptional<z.ZodString>;
     state: z.ZodString;
 }, z.core.$loose>;
-type AuthorizationRequest = z.infer<typeof zAuthorizationRequest>;
+type AuthorizationRequestV1_3 = z.infer<typeof zAuthorizationRequestV1_3>;
 declare const zPushedAuthorizationRequestSigned: z.ZodObject<{
     client_id: z.ZodString;
     pkceCodeVerifier: z.ZodString;
     request: z.ZodString;
 }, z.core.$loose>;
 type PushedAuthorizationRequestSigned = z.infer<typeof zPushedAuthorizationRequestSigned>;
-declare const zPushedAuthorizationRequestUnsigned: z.ZodObject<{
+declare const zPushedAuthorizationRequestUnsignedV1_0: z.ZodObject<{
     authorizationRequest: z.ZodObject<{
         authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             credential_configuration_id: z.ZodString;
@@ -1335,7 +1377,32 @@ declare const zPushedAuthorizationRequestUnsigned: z.ZodObject<{
         issuer_state: z.ZodOptional<z.ZodString>;
         jti: z.ZodString;
         redirect_uri: z.ZodURL;
+        response_type: z.ZodString;
+        scope: z.ZodOptional<z.ZodString>;
+        state: z.ZodString;
         response_mode: z.ZodString;
+    }, z.core.$loose>;
+    client_id: z.ZodString;
+    pkceCodeVerifier: z.ZodString;
+}, z.core.$loose>;
+type PushedAuthorizationRequestUnsignedV1_0 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
+declare const zPushedAuthorizationRequestUnsignedV1_3: z.ZodObject<{
+    authorizationRequest: z.ZodObject<{
+        authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            credential_configuration_id: z.ZodString;
+            type: z.ZodLiteral<"openid_credential">;
+        }, z.core.$strip>, z.ZodObject<{
+            challenge_method: z.ZodLiteral<"mrtd+ias">;
+            challenge_redirect_uri: z.ZodURL;
+            idphinting: z.ZodURL;
+            type: z.ZodLiteral<"it_l2+document_proof">;
+        }, z.core.$strip>], "type">>>;
+        client_id: z.ZodString;
+        code_challenge: z.ZodString;
+        code_challenge_method: z.ZodString;
+        issuer_state: z.ZodOptional<z.ZodString>;
+        jti: z.ZodString;
+        redirect_uri: z.ZodURL;
         response_type: z.ZodString;
         scope: z.ZodOptional<z.ZodString>;
         state: z.ZodString;
@@ -1343,21 +1410,22 @@ declare const zPushedAuthorizationRequestUnsigned: z.ZodObject<{
     client_id: z.ZodString;
     pkceCodeVerifier: z.ZodString;
 }, z.core.$loose>;
-type PushedAuthorizationRequestUnsigned = z.infer<typeof zPushedAuthorizationRequestUnsigned>;
+type PushedAuthorizationRequestUnsignedV1_3 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
 /**
  * Union type for Pushed Authorization Request - can be either signed (JAR) or unsigned.
  * The variant depends on the Authorization Server's require_signed_request_object metadata.
  */
-type PushedAuthorizationRequest = PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsigned;
+type PushedAuthorizationRequest = PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
 declare function isPushedAuthorizationRequestSigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestSigned;
-declare function isPushedAuthorizationRequestUnsigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestUnsigned;
+declare function isPushedAuthorizationRequestUnsigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
 declare const zPushedAuthorizationResponse: z.ZodObject<{
     expires_in: z.ZodNumber;
     request_uri: z.ZodString;
 }, z.core.$loose>;
 type PushedAuthorizationResponse = z.infer<typeof zPushedAuthorizationResponse>;
 
-interface CreatePushedAuthorizationRequestOptions {
+type AuthorizationRequest$1 = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
+interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVersion> {
     /**
      * It MUST be set to the identifier of the Credential Issuer.
      */
@@ -1365,7 +1433,7 @@ interface CreatePushedAuthorizationRequestOptions {
     /**
      * Allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures
      */
-    authorization_details?: AuthorizationRequest["authorization_details"];
+    authorization_details?: AuthorizationRequest$1["authorization_details"];
     /**
      * Authorization Server metadata for conditional JAR signing.
      * When require_signed_request_object is true, creates a signed JWT (JAR).
@@ -1386,6 +1454,7 @@ interface CreatePushedAuthorizationRequestOptions {
      */
     clientId: string;
     codeChallengeMethodsSupported: ItWalletAuthorizationServerMetadata["code_challenge_methods_supported"];
+    config: IoWalletSdkConfig<V>;
     /**
      * DPoP options. Required when `require_signed_request_object` is `true`
      * (enforced at the type level via function overloads). Not used in the
@@ -1412,10 +1481,6 @@ interface CreatePushedAuthorizationRequestOptions {
      * Redirect uri to include in the authorization request
      */
     redirectUri: string;
-    /**
-     * It MUST be one of the supported values (response_modes_supported) provided in the metadata of the Credential Issuer.
-     */
-    responseMode: string;
     /**
      * Scope to request for the authorization request
      */
@@ -1425,6 +1490,25 @@ interface CreatePushedAuthorizationRequestOptions {
      */
     state?: string;
 }
+interface CreatePushedAuthorizationRequestOptionsV1_0 extends BaseCreatePushedAuthorizationRequestOptions<ItWalletSpecsVersion.V1_0> {
+    /**
+     * It MUST be one of the supported values (response_modes_supported) provided in the metadata of the Credential Issuer.
+     */
+    responseMode: string;
+}
+type CreatePushedAuthorizationRequestOptionsV1_3 = BaseCreatePushedAuthorizationRequestOptions<ItWalletSpecsVersion.V1_3>;
+type CreatePushedAuthorizationRequestOptions = CreatePushedAuthorizationRequestOptionsV1_0 | CreatePushedAuthorizationRequestOptionsV1_3;
+type CreatePushedAuthorizationRequestOptionsSigned<TOptions extends CreatePushedAuthorizationRequestOptions> = {
+    authorizationServerMetadata: {
+        require_signed_request_object: true;
+    };
+    dpop: RequestDpopOptions;
+} & TOptions;
+type CreatePushedAuthorizationRequestOptionsUnsigned<TOptions extends CreatePushedAuthorizationRequestOptions> = {
+    authorizationServerMetadata: {
+        require_signed_request_object: false;
+    };
+} & TOptions;
 /**
  * Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.
  *
@@ -1457,7 +1541,8 @@ interface CreatePushedAuthorizationRequestOptions {
  * @param options.jti - Optional JWT ID for PAR (auto-generated if not provided)
  * @param options.pkceCodeVerifier - Optional PKCE code verifier (auto-generated if not provided)
  * @param options.redirectUri - Redirect URI for the authorization response
- * @param options.responseMode - Response mode (must be supported by Credential Issuer)
+ * @param options.config - Italian Wallet specification version used to build the request shape
+ * @param options.responseMode - Response mode (v1.0 only, must be supported by Credential Issuer)
  * @param options.scope - OAuth 2.0 scope to request
  * @param options.state - Optional state parameter (auto-generated if not provided)
  * @param options.expiresAt - Optional JWT expiration time (defaults to 1 hour from issuedAt)
@@ -1465,19 +1550,24 @@ interface CreatePushedAuthorizationRequestOptions {
  *
  * @returns A promise resolving to either:
  *   - `PushedAuthorizationRequestSigned` when JAR signing is required (contains `request` JWT)
- *   - `PushedAuthorizationRequestUnsigned` when JAR signing is not required (contains `authorizationRequest` object)
+ *   - version-specific unsigned PAR when JAR signing is not required (contains `authorizationRequest` object)
  *
  * @throws {PushedAuthorizationRequestError} If DPoP signer is missing required properties (alg, publicJwk.kid)
  * @throws {PushedAuthorizationRequestError} If PKCE code challenge method is not supported
  * @throws {ZodError} If authorization request parameters fail validation
  *
  * @example
- * // Example 1: Create signed PAR (explicit)
+ * // Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
+ * const config = new IoWalletSdkConfig({
+ *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
+ * });
+ *
  * const signedPar = await createPushedAuthorizationRequest({
  *   audience: 'https://issuer.example.com',
  *   callbacks: { generateRandom, hash, signJwt },
  *   clientId: 'wallet_client_thumbprint',
  *   codeChallengeMethodsSupported: ['S256'],
+ *   config,
  *   dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
  *   redirectUri: 'https://wallet.example.com/callback',
  *   responseMode: 'form_post.jwt',
@@ -1489,14 +1579,18 @@ interface CreatePushedAuthorizationRequestOptions {
  * // signedPar.request contains the signed JWT
  *
  * @example
- * // Example 2: Create unsigned PAR (when Authorization Server allows it)
+ * // Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
+ * const config = new IoWalletSdkConfig({
+ *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
+ * });
+ *
  * const unsignedPar = await createPushedAuthorizationRequest({
  *   audience: 'https://issuer.example.com',
  *   callbacks: { generateRandom, hash, signJwt },
  *   clientId: 'wallet_client_thumbprint',
  *   codeChallengeMethodsSupported: ['S256'],
+ *   config,
  *   redirectUri: 'https://wallet.example.com/callback',
- *   responseMode: 'query',
  *   scope: 'openid',
  *   authorizationServerMetadata: {
  *     require_signed_request_object: false  // Creates unsigned request — dpop not needed
@@ -1505,12 +1599,17 @@ interface CreatePushedAuthorizationRequestOptions {
  * // unsignedPar.authorizationRequest contains the plain object
  *
  * @example
- * // Example 3: Default behavior (no metadata - unsigned)
+ * // Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
+ * const config = new IoWalletSdkConfig({
+ *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
+ * });
+ *
  * const par = await createPushedAuthorizationRequest({
  *   audience: 'https://issuer.example.com',
  *   callbacks: { generateRandom, hash, signJwt },
  *   clientId: 'wallet_client_thumbprint',
  *   codeChallengeMethodsSupported: ['S256'],
+ *   config,
  *   redirectUri: 'https://wallet.example.com/callback',
  *   responseMode: 'form_post.jwt',
  *   scope: 'openid'
@@ -1522,17 +1621,11 @@ interface CreatePushedAuthorizationRequestOptions {
  * @see {@link https://datatracker.ietf.org/doc/html/rfc9101 RFC 9101 - JWT-Secured Authorization Request (JAR)}
  * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5 - require_signed_request_object}
  */
-declare function createPushedAuthorizationRequest(options: {
-    authorizationServerMetadata: {
-        require_signed_request_object: true;
-    };
-    dpop: RequestDpopOptions;
-} & CreatePushedAuthorizationRequestOptions): Promise<PushedAuthorizationRequestSigned>;
-declare function createPushedAuthorizationRequest(options: {
-    authorizationServerMetadata: {
-        require_signed_request_object: false;
-    };
-} & CreatePushedAuthorizationRequestOptions): Promise<PushedAuthorizationRequestUnsigned>;
+declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsSigned<CreatePushedAuthorizationRequestOptions>): Promise<PushedAuthorizationRequestSigned>;
+declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsUnsigned<CreatePushedAuthorizationRequestOptionsV1_0>): Promise<PushedAuthorizationRequestUnsignedV1_0>;
+declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsV1_0): Promise<PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_0>;
+declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsUnsigned<CreatePushedAuthorizationRequestOptionsV1_3>): Promise<PushedAuthorizationRequestUnsignedV1_3>;
+declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsV1_3): Promise<PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_3>;
 declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptions): Promise<PushedAuthorizationRequest>;
 
 /**
@@ -1622,9 +1715,11 @@ interface ParseAuthorizationRequestResult {
  */
 declare function parseAuthorizationRequest(options: ParseAuthorizationRequestOptions): ParseAuthorizationRequestResult;
 
+type AuthorizationRequest = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
 interface ParsePushedAuthorizationRequestOptions {
     authorizationRequest: unknown;
     callbacks: Pick<CallbackContext, "fetch">;
+    config: IoWalletSdkConfig;
     request: RequestLike$1;
 }
 interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
@@ -2311,15 +2406,16 @@ type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOption
  * Anonymous client authentication
  */
 declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
-interface ClientAuthenticationWalletAttestationJwtOptions {
+interface ClientAuthenticationWalletAttestationJwtOptions<V extends ItWalletSpecsVersion = ItWalletSpecsVersion> {
     callbacks: Pick<CallbackContext, "generateRandom" | "signJwt">;
+    config: IoWalletSdkConfig<V>;
     walletAttestationJwt: string;
 }
 /**
  * Client authentication using wallet attestation JWT.
  * This method adds the wallet attestation JWT and a proof-of-possession JWT to the request headers.
  */
-declare function clientAuthenticationWalletAttestationJwt(options: ClientAuthenticationWalletAttestationJwtOptions): ClientAuthenticationCallback;
+declare function clientAuthenticationWalletAttestationJwt<V extends ItWalletSpecsVersion = ItWalletSpecsVersion>(options: ClientAuthenticationWalletAttestationJwtOptions<V>): ClientAuthenticationCallback;
 
 /**
  * JWT Header schema for IT-Wallet v1.0 Wallet Attestation
@@ -2732,6 +2828,96 @@ interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions
 }
 declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;
 
+declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
+declare const zItWalletClientAttestationPopJwtAlg: z.ZodEnum<{
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+}>;
+type ItWalletClientAttestationPopJwtAlg = z.infer<typeof zItWalletClientAttestationPopJwtAlg>;
+declare const zItWalletClientAttestationPopJwtPayload: z.ZodObject<{
+    aud: z.ZodString;
+    exp: z.ZodOptional<z.ZodNumber>;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    jti: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    cnf: z.ZodOptional<z.ZodObject<{
+        jkt: z.ZodOptional<z.ZodString>;
+        jwk: z.ZodOptional<z.ZodObject<{
+            alg: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            d: z.ZodOptional<z.ZodString>;
+            dp: z.ZodOptional<z.ZodString>;
+            dq: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            ext: z.ZodOptional<z.ZodBoolean>;
+            k: z.ZodOptional<z.ZodString>;
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodString;
+            n: z.ZodOptional<z.ZodString>;
+            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                d: z.ZodOptional<z.ZodString>;
+                r: z.ZodOptional<z.ZodString>;
+                t: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>>;
+            p: z.ZodOptional<z.ZodString>;
+            q: z.ZodOptional<z.ZodString>;
+            qi: z.ZodOptional<z.ZodString>;
+            use: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            x5t: z.ZodOptional<z.ZodString>;
+            "x5t#S256": z.ZodOptional<z.ZodString>;
+            x5u: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+}, z.core.$loose>;
+type ItWalletClientAttestationPopJwtPayload = z.infer<typeof zItWalletClientAttestationPopJwtPayload>;
+declare const zItWalletClientAttestationPopJwtTyp: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
+declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
+    typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
+    alg: z.ZodString;
+    jwk: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodOptional<z.ZodString>;
+        crv: z.ZodOptional<z.ZodString>;
+        d: z.ZodOptional<z.ZodString>;
+        dp: z.ZodOptional<z.ZodString>;
+        dq: z.ZodOptional<z.ZodString>;
+        e: z.ZodOptional<z.ZodString>;
+        ext: z.ZodOptional<z.ZodBoolean>;
+        k: z.ZodOptional<z.ZodString>;
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        kid: z.ZodOptional<z.ZodString>;
+        kty: z.ZodString;
+        n: z.ZodOptional<z.ZodString>;
+        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            d: z.ZodOptional<z.ZodString>;
+            r: z.ZodOptional<z.ZodString>;
+            t: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+        p: z.ZodOptional<z.ZodString>;
+        q: z.ZodOptional<z.ZodString>;
+        qi: z.ZodOptional<z.ZodString>;
+        use: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodString>;
+        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        x5t: z.ZodOptional<z.ZodString>;
+        "x5t#S256": z.ZodOptional<z.ZodString>;
+        x5u: z.ZodOptional<z.ZodString>;
+        y: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    kid: z.ZodOptional<z.ZodString>;
+    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+type ItWalletClientAttestationPopJwtHeader = z.infer<typeof zItWalletClientAttestationPopJwtHeader>;
+
 interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
     /**
      * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
@@ -3562,4 +3748,4 @@ declare const zDpopJwtHeader: z.ZodObject<{
 }, z.core.$loose>;
 type DpopJwtHeader = z.infer<typeof zDpopJwtHeader>;
 
-export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequest, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsigned, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequest, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsigned, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };
+export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };